Signature Base unknown stable yara

HKTL_RedSun_Privilege_Escalation_Apr26 [yara]

Detects RedSun hacktool used for privilege escalation through Microsoft Defender.

View Source

Detection Logic

uint16(0) == 0x5a4d
      and (
         1 of ($x*)
         or 2 of ($s*)
      )
      or 3 of them

Field Validations

Loading…

Comments (0)

Loading comments...